Secure computation system, secure computation device, secure computation method, and program

ABSTRACT

Fisher&#39;s exact test is efficiently computed through secure computation. It is assumed that a, b, c and d are frequencies of a 2×2 contingency table, [a], [b], [c] and [d] are secure texts of the respective frequencies a, b, c and d, and N is an upper bound satisfying a+b+c+dN. A reference frequency computation part computes a secure text ([a 0 ], [b 0 ], [c 0 ], [d 0 ]) of a combination of reference frequencies (a 0 , b 0 , c 0 , d 0 ) which are integers satisfying a 0 +b 0 =a+b, c 0 +d 0 =c+d, a 0 +c 0 =a+c, and b 0 +d 0 =b+d. A number-of-patterns determination part determines integers h 0  and h 1  satisfying h 0 ≤h 1 . A pattern computation part computes [ai]=[a 0 ]+i, [b i ]=[b 0 ]−i, [c i ]=[c 0 ]−i and [d i ]=[d 0 ]+i for i=h 0 , . . . , h 1 , and obtains a set S={([a i ], [b i ], [c i ], [d i ])} i  of secure texts of combinations of frequencies (a i , b i , c i , d i ).

TECHNICAL FIELD

The present invention relates to applied cryptographic technology and,in particular, to technology of computing Fisher's exact test withoutdisclosing input data.

BACKGROUND ART

Fisher's exact test has been widely known as one of statistical testmethods that perform a hypothesis test on the presence or absence of anassociation between explanatory variables and response variablesprovided as a 2×2 contingency table. Non-patent literature 1 describesthe genome-wide association study (GWAS) as a usage example of Fisher'sexact test.

Fisher's exact test is described. The following table is an example of a2×2 contingency table where n subjects are classified and countedaccording to the presence or absence of mutation and the presence orabsence of the onset of a predetermined disease.

With Without Subtotal due mutation mutation to disease With disease a bn_(1•) Without disease c d n_(2•) Subtotal due to n_(•1) n_(•2) nmutationa, b, c and d represent frequencies. n_(1•), n_(2•), n_(•1) and n_(•2)represent subtotals. n_(1•)=a+b, n_(2•)=c+d, n_(•1)=a+c, n_(•2)=b+d. Allof a, b, c, d, n_(1•), n_(2•), n_(•1) and n_(•2) are non-negativeintegers.

Here, for a non-negative integer i, the probability p_(i) defined by anequation (1) is computed. According to the magnitude relationshipbetween the sum of probabilities p represented by an equation (2) and apredetermined value α, which is called a significance level, thepresence or absence of association between explanatory variables (thepresence or absence of mutation in the above table) and responsevariables (the presence or absence of the disease in the above table) istested. Here, p_(a) is a probability value computed by the equation (1)about the contingency table where actual aggregation values a, b, c andd are adopted as frequencies.

$\begin{matrix}{p_{i} = \frac{{\left( {a + b} \right)!}{\left( {c + d} \right)!}{\left( {a + c} \right)!}{\left( {b + d} \right)!}}{{i!}{\left( {a + b - i} \right)!}{\left( {a + c - i} \right)!}{\left( {d - a + i} \right)!}{\left( {a + b + c + d} \right)!}}} & (1) \\{p = {\sum\limits_{{i\mspace{14mu}{s.t}\mspace{14mu} p_{i}} \leq p_{a}}p_{i}}} & (2)\end{matrix}$

Methods of obtaining specific operation results without decryptingencrypted numerical values include a method called secure computation(see Non-patent literature 2, for example). The method of Non-patentliterature 2 performs encryption that allows three secure computationdevices to hold the divided fragments of the numerical value, and thethree secure computation devices perform cooperative computation, whichcan allow the three secure computation devices to hold the results ofaddition and subtraction, constant addition, multiplication, constantmultiplication, logical operation (negation, logical multiplication,logical addition, and exclusive OR), and data notation conversion(integer, and binary numeral) without decrypting the numerical value, ina state of being distributed among the three secure computation devices,i.e., being left encrypted.

There is a conventional research that performs genome-wide associationstudy while keeping genome information secret using cryptographictechnology, in consideration of the sensitivity and secrecy of thegenome information (see Non-patent literature 3, for example).Non-patent literature 3 proposes a method of performing a chi-squaretest while keeping genome information secret.

PRIOR ART LITERATURE Non-Patent Literature

-   Non-patent literature 1: Konrad Karczewski, “How to do a GWAS”,    Lecture note in GENE 210: Genomics and Personalized Medicine, 2015.-   Non-patent literature 2: Koji Chida, Koki Hamada, Dai Ikarashi, and    Katsumi Takahashi, “A Three-Party Secure Function Evaluation with    Lightweight Verifiability Revisited”, CSS 2010, 2010.-   Non-patent literature 3: Yihua Zhang, Marina Blanton, and Ghada    Almashaqbeh, “Secure distributed genome analysis for gwas and    sequence comparison computation”, BMC medical informatics and    decision making, Vol. 15, No. Suppl 5, p. S4, 2015.

SUMMARY OF THE INVENTION Problems to be Solved by the Invention

However, according to the conventional art, for computation of eachprobability p_(i), it is assumed that a_(i)=i, b_(i)=b+a−i, c_(i)=c+a−i,and d_(i)=d−a+i, it is also assumed that the maximum i with b_(i)≥0 andc_(i)≥0 is i₁ and it is also assumed that the minimum i with a_(i)≥0 andd_(i)≥0 is i₀, and then p_(i) is computed for each i that satisfiesi₀≤i≤i₁. Here, the number of combinations of frequencies (a_(i), b_(i),c_(i) and d_(i)) to be computed is identified based on the values of i₀and i₁. The number can be used for information for estimating inputvalues a, b, c and d. Accordingly, secure texts {([a_(i)], [b_(i)],[c_(i)] and [d_(i)])}_(i) of the combination of frequencies (a_(i),b_(i), c_(i) and d_(i)) to be computed cannot be obtained while keepingthe input secret.

In view of the above point, the secure computation technology of thepresent invention has an object to compute Fisher's exact testefficiently through secure computation.

Means to Solve the Problems

To solve the above problems, the secure computation system of thepresent invention is a secure computation system comprising three ormore secure computation devices, wherein it is assumed that a, b, c andd are non-negative integers, a is a frequency on a first row and a firstcolumn of a 2×2 contingency table, b is a frequency on the first row anda second column of the contingency table, c is a frequency on a secondrow and the first column of the contingency table, d is a frequency onthe second row and the second column of the contingency table, [a], [b],[c] and [d] are secure texts of the respective frequencies a, b, c andd, and N is an upper bound satisfying a+b+c+d, the secure computationdevice comprises: a reference frequency computation part that computes asecure text ([a₀], [b₀], [c₀], [d₀]) of a combination of referencefrequencies (a₀, b₀, c₀, d₀) which are integers satisfying a₀+b₀=a+b,c₀+d₀=c+d, a₀+c₀=a+c, and b₀+d₀=b+d; a number-of-patterns determinationpart that determines integers h₀ and h₁ satisfying h₀≤h₁; and a patterncomputation part that computes [a_(i)]=[a₀]+i, [b_(i)]=[b₀]−i,[c_(i)]=[c₀]−i and [d_(i)]=[d₀]+i for i=h₀, . . . , h₁, and obtains aset S={([a_(i)], [b_(i)], [c_(i)], [d_(i)])}_(i) of secure texts ofcombinations of frequencies (a_(i), b_(i), c_(i), d_(i)).

Effects of the Invention

The present invention can enumerate the combinations of frequencies(a_(i), b_(i), c_(i), d_(i)) while reducing the number of elements ofthe set S={([a_(i)], [b_(i)], [c_(i)], [d_(i)])}_(i) of secure texts tobe output, without disclosing the number of combinations of frequencies(a_(i), b_(i), c_(i), d_(i)) which are computation targets of Fisher'sexact test. Consequently, Fisher's exact test can be efficientlycomputed through secure computation. Specifically, the effects ofreducing the amount of use of computational resources and of reducingthe processing time to about ½ can be expected. Furthermore, Fisher'sexact test can be executed, with the genome information being keptsecret. That is, for example, execution results of Fisher's exact teston integrated data can be obtained while genome data items held bymultiple research institutes are kept secret and are not disclosed toeach other, an execution environment for genome analysis having asignificantly high security level can be provided, and furtherdevelopment in healthcare can be expected accordingly.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a diagram exemplifying a functional configuration of a securecomputation system;

FIG. 2 is a diagram exemplifying a functional configuration of a securecomputation device; and

FIG. 3 is a diagram exemplifying processing procedures of a securecomputation method.

DETAILED DESCRIPTION OF THE EMBODIMENTS

Prior to the description of embodiments, the notation scheme in thisDescription is described.

<Notation>

A value secured by applying encryption or secret sharing to a certainvalue “a” is called the secure text of “a” and is represented as [a].Meanwhile, “a” is called the plain text of [a]. In a case where thesecuring is secret sharing, a set of the secret sharing fragments heldby the individual parties according to [a] is referred to.

Hereinafter, embodiments of the present invention are described indetail. In the diagrams, configuration parts having the same functionsare assigned the same numerals, and redundant description thereof isomitted.

First Embodiment

A secure computation system of a first embodiment comprises n (≥3)secure computation devices 1 ₁, . . . , 1 _(n), as exemplified inFIG. 1. In this embodiment, the secure computation devices 1 ₁, . . . ,1 _(n) are each connected to a communication network 2. Thecommunication network 2 is a communication network that is of a circuitswitching scheme or a packet switching scheme and is configured to allowthe secure computation devices 1 ₁, . . . , 1 _(n) to communicate witheach other. For example, the Internet, a LAN (Local Area Network), a WAN(Wide Area Network) or the like may be used. Each device is notnecessarily capable of communicating online via the communicationnetwork 2. For example, it may be configured such that information to beinput into the secure computation devices 1 _(i) (i∈{1, . . . , n}) maybe stored in a portable recording medium, such as magnetic tape or a USBmemory, and input may be performed offline from the portable recordingmedium.

As exemplified in FIG. 2, the secure computation device 1 includes aninput part 11, a reference frequency computation part 12, anumber-of-patterns determination part 13, a pattern computation part 14,and an output part 15. The secure computation device 1 performs theprocess of each step exemplified in FIG. 3, thereby achieving a securecomputation method of the first embodiment.

The secure computation device 1 is, for example, a special deviceconfigured to include a publicly known or dedicated computer whichincludes a central processing unit (CPU) and a main memory (RAM: RandomAccess Memory) and the like and into which a special program has beenread. The secure computation device 1 executes each process undercontrol by the central processing unit, for example. Data input into thesecure computation device 1 and data obtained by each process are storedin the main memory, for example. The data stored in the main memory isread into the central processing unit as required, and is used foranother process. At least some of the processing parts of the securecomputation device 1 may be configured by hardware, such as anintegrated circuit.

Referring to FIG. 3, the processing procedures of the secure computationmethod of the first embodiment are described.

In step S11, a secure text ([a], [b], [c], [d]) of a combination offrequencies (a, b, c, d) in a 2×2 contingency table, and an upper boundN that satisfies a+b+c+d≤T are input into the input part 11. Here, the2×2 contingency table is defined by the following formulae, and a, b, cand d are non-negative integers.

Without Subtotal due With event 1 event 1 to event 2 With event 2 a bn_(1•) Without event 2 c d n_(2•) Subtotal due to n_(•1) n_(•2) n event1

In step S12, the reference frequency computation part 12 uses the securetext ([a], [b], [c], [d]) of the combination of the frequencies (a, b,c, d) to compute a secure text ([a₀], [b₀], [c₀], [d₀]) of a combinationof integers (a₀, b₀, c₀, d₀) satisfying the following equations.Hereinafter, a₀, b₀, c₀ and d₀ are called reference frequenciesa ₀ +b ₀ =a+b,c ₀ ±d ₀ =c+d,a ₀ +c ₀ =a+c,b ₀ +d ₀ =b+d

For example, the reference frequency computation part 12 may compute thefollowing equations to obtain the secure text ([a₀], [b₀], [c₀], [d₀])of the combination of the reference frequencies (a₀, b₀, c₀, d₀).[a ₀]=0,[b ₀]=[b]+[a],[c ₀]=[c]+[a],[d ₀]=[d]−[a]

In step S13, the number-of-patterns determination part 13 determinesintegers h₀ and h₁ that satisfy h₀≤h₁. Here, it is determined such thath₀=0, and h₁=N, for example.

In step S14, the pattern computation part 14 computes the followingequations for each integer i ranging from h₀ to h₁, inclusive, to obtainthe secure text ([a_(i)], [b_(i)], [c_(i)], [d_(i)]) of the combinationof frequencies (a_(i), b_(i), c_(i), d_(i)).[a _(i)]=[a ₀]+i,[b _(i)]=[b ₀]−i,[c _(i)]=[c ₀]−i,[d _(i)]=[d ₀]+i

In step S15, a set S={([a_(i)], [b_(i)], [c_(i)],[d_(i)])}_(i=h0, . . . , h1) of secure texts of the combinations of(h₁−h₀+1) frequencies (a_(i), b_(i), c_(i), d_(i)) is output from theoutput part 15.

The set S is a set where only one j∈{h₀, . . . , h₁} resides thatsatisfies a′=a_(j), b′=b_(j), c′=c_(j) and d′=d_(j) for everycombination of integers (a′, b′, c′, d′) satisfying a′≥0, b′≥0, c′≥0,d′≥0, a′+b′=a+b, c′+d′=c+d, a′+c′=a+c and b′+d′=b+d. That is, the setmutually exclusively includes all combinations of non-negative integerswith values varying so as not to change the subtotals in the contingencytable, for given a, b, c and d. Here, the set S may include combinationsof integers (that may include negative integers) with each subtotalbeing the same in the contingency table.

According to the secure computation technology of the first embodiment,the number of secure texts of the combinations of frequencies includedin the output set S is determined by the disclosed value N.Consequently, the given frequencies a, b, c and d cannot be estimated.Accordingly, the combinations of frequencies which are computationtargets of the Fisher's exact test can be enumerated, with the inputbeing kept secret.

Second Embodiment

Referring to FIG. 3, the processing procedures of the secure computationmethod of a second embodiment are described. Hereinafter, differencesfrom the first embodiment described above are mainly described.

In step S12, the reference frequency computation part 12 computes[e]=min([a], [d]). Here min(•) is a function of outputting the minimumvalue among the arguments. That is, [a] and [d] are compared with eachother with the values being kept secret, and secure text of the smallervalue is regarded as [e]. Subsequently, the reference frequencycomputation part 12 computes the following equations to obtain thesecure text ([a₀], [b₀], [c₀], [d₀]) of the combination of the referencefrequencies (a₀, b₀, c₀, d₀).[a ₀]=[a]−[e],[b ₀]=[b]+[e],[c ₀]=[c]+[e],[d ₀]=[d]−[e]

In step S13, the number-of-patterns determination part 13 computes h₀=0and h₁=floor(N/2) to determine the integers h₀ and h₁. Here, floor(•) isa floor function for outputting the maximum integer equal to or lessthan •. That is, h₁ can be represented by the following equation.

$h_{1} = \left\lfloor \frac{N}{2} \right\rfloor$

In step S14, the pattern computation part 14 uses the secure text [a₀],[b₀], [c₀], [d₀]) of the combination of the reference frequencies (a₀,b₀, c₀, d₀) and the integers h₀ and h₁ obtained as described above toobtain the secure text ([a_(i)], [b_(i)], [c_(i)], [d_(i)]) of thecombination of frequencies (a_(i), b_(i), c_(i), d_(i)), as with thefirst embodiment.

According to the secure computation technology of the second embodiment,the number of secure texts of the combinations of frequencies includedin the output set S is determined by the disclosed value N, as with thefirst embodiment. Consequently, the given frequencies a, b, c and dcannot be estimated. In comparison with the first embodiment, the numberof secure texts of the combination of the frequencies included in theset S decreases. Consequently, Fisher's exact test can be moreefficiently computed.

According to the configuration as described above, the securecomputation technology of the present invention can enumerate all thecombinations of frequencies which are to be computed, without disclosingthe number of combinations of the frequencies (a, b, c, d) which are tobe computed, and can efficiently compute Fisher's exact test throughsecure computation without disclosing the input information.

The embodiments of the present invention have thus been described above.However, the specific configuration is not limited to that in theseembodiments. Even if the design is appropriately changed in a rangewithout departing from the spirit of the present invention, it is amatter of course that the configuration is included in the presentinvention. The various processes described in the embodiments can beexecuted in a time-series manner according to the order of thedescription. Alternatively, such execution may be performed in parallelor individually, in conformity with the processing capability of thedevice that executes the processes, or as required.

[Program and Recording Medium]

In the cases where the various processing functions in each devicedescribed in the embodiments are implemented with a computer, theprocessing content of the functions that each device should have isdescribed as a program. The program is executed by the computer, therebyachieving the various processing functions in each device describedabove on the computer.

The program that describes the processing content can be preliminarilyrecorded in a computer-readable recording medium. The computer-readablerecording medium may be, for example, any computer-readable recordingmedium, such as a magnetic recording device, an optical disk, amagneto-optical recording medium, or a semiconductor memory.

The program is distributed by, for example, selling, transferring, orlending a portable recording medium, such as DVD or CD-ROM, where theprogram is recorded. Alternatively, a configuration may be adopted wherethe program may be preliminarily stored in a storing device of a servercomputer, and the program may be transferred from the server computer toanother computer via a network, thereby distributing the program.

For example, the computer for executing such a program, first, storesthe program recorded in a portable recording medium or transferred froma server computer, temporarily in its storing device. At the time ofexecuting the process, the computer reads the program recorded in itsrecording medium, and executes the processes according to the readprogram. According to another execution mode of this program, thecomputer may directly read the program from the portable recordingmedium, and execute the processes according to the program. Furtheralternatively, every time the program is transferred to the computerfrom the server computer, the computer may successively execute theprocess according to the received program. Another configuration may beadopted that executes the processes described above through a service ofwhat is called an ASP (Application Service Provider) type according towhich the program is not transferred from the server computer to thecomputer concerned, and the processing function is achieved only by anexecution instruction therefor and acquisition of the result. Theprogram according to the embodiments include information that isprovided for the processes by the computer and conforms to the program(data and the like that are not direct instructions to the computer buthave characteristics defining the processes of the computer).

According to the embodiments, this device is thus configured byexecuting a predetermined program on the computer. Alternatively, atleast a part of the processing content may be achieved as hardware.

INDUSTRIAL APPLICABILITY

As is obvious from the result of application to the genome-wideassociation study described above, the secure computation technology ofthe present invention is applicable to execution of Fisher's exact testthrough secure computation with information on an aggregate table beingkept secret, in analysis using Fisher's exact test, for example,genome-wide association study, genome analysis, clinical research,social investigation, academic research, analysis of examinationresults, marketing research, statistical computation, medicalinformation analysis, customer information analysis, and sales analysis.

What is claimed is:
 1. A secure computation system comprising three ormore secure computation devices, wherein it is assumed that a, b, c andd are non-negative integers, a is a frequency on a first row and a firstcolumn of a 2×2 contingency table, b is a frequency on the first row anda second column of the contingency table, c is a frequency on a secondrow and the first column of the contingency table, d is a frequency onthe second row and the second column of the contingency table, [a], [b],[c] and [d] are secure texts of the respective frequencies a, b, c andd, and N is an upper bound satisfying a+b+c+d≤N, each secure computationdevice comprises circuitry configured to: receive, over a network, aninput of the secure texts ([a], [b], [c], [d]), wherein the originalrespective frequencies a, b, c and d are concealed from each of thesecret computation devices; compute a secure text ([a₀], [b₀], [c₀],[d₀]) of a combination of reference frequencies (a₀, b₀, c₀, d₀) whichare integers satisfying a₀+b₀=a+b, c₀+d₀=c+d, a₀+c₀=a+c, and b₀+d₀=b+d;determine integers h₀ and h₁ satisfying h₀≤h₁; and compute[a_(i)]=[a₀]+i, [b_(i)]=[b₀]−i, [c_(i)]=[c₀]−i and [d_(i)]=[d₀]+i fori=h₀, . . . , h₁, and obtain a set S={([a_(i)], [b_(i)], [c_(i)],[d_(i)])}_(i) of secure texts of combinations of frequencies (a_(i),b_(i), c_(i), d_(i)).
 2. The secure computation system according toclaim 1, wherein the circuitry computes [a₀]=0, [b₀]=[b]+[a],[c₀]=[c]+[a] and [d₀]=[d]−[a], obtains the secure text ([a₀], [b₀],[c₀], [d₀]), and determines h₀=0, and h₁=N.
 3. The secure computationsystem according to claim 1, wherein min(•) represents a minimum valueamong arguments •, and floor(•) represents a maximum integer equal to orless than a value •, the circuitry computes [e]=min([a], [d]), computes[a₀]=[a]−[e], [b₀]=[b]+[e], [c₀]=[c]+[e] and [d₀]=[d]−[e], obtains thesecure text ([a₀], [b₀], [c₀], [d₀]), and determines that h₀=0,h₁=floor(N/2).
 4. The secure computation system according to any one ofclaims 1 to 3, wherein the contingency table is genome informationobtained by classifying and counting according to presence or absence ofmutation and presence or absence of an onset of a disease.
 5. A securecomputation device configured to be implemented in a secure computationsystem comprising three or more secure computation devices, wherein itis assumed that a, b, c and d are non-negative integers, a is afrequency on a first row and a first column of a 2×2 contingency table,b is a frequency on the first row and a second column of the contingencytable, c is a frequency on a second row and the first column of thecontingency table, d is a frequency on the second row and the secondcolumn of the contingency table, [a], [b], [c] and [d] are secure textsof the respective frequencies a, b, c and d, and N is an upper boundsatisfying a+b+c+d≤N, the secure computation device comprises circuitryconfigured to: receive, over a network, an input of the secure texts([a], [b], [c], [d]), wherein the original respective frequencies a, b,c and d are concealed from the secret computation devices in the securecomputation system; compute a secure text ([a₀], [b₀], [c₀], [d₀]) of acombination of reference frequencies (a₀, b₀, c₀, d₀) which are integerssatisfying a₀, b₀=a+b, c₀+d₀=c+d, a₀+c₀=a+c, and b₀+d₀=b+d; determineintegers h₀ and h₁ satisfying h₀≤h₁; and compute [a_(i)]=[a₀]+i,[b_(i)]=[b₀]−i, [c_(i)]=[c₀]−i and [d_(i)]=[d₀]+i for i=h₀, . . . , h₁,and obtain a set S={([a_(i)], [b_(i)], [c_(i)], [d_(i)])}_(i) of securetexts of combinations of frequencies (a_(i), b₁, c_(i), d_(i)).
 6. Asecure computation method implemented in a secure computation systemcomprising three or more secure computation devices, wherein it isassumed that a, b, c and d are non-negative integers, a is a frequencyon a first row and a first column of a 2×2 contingency table, b is afrequency on the first row and a second column of the contingency table,c is a frequency on a second row and the first column of the contingencytable, d is a frequency on the second row and the second column of thecontingency table, [a], [b], [c] and [d] are secure texts of therespective frequencies a, b, c and d, and N is an upper bound satisfyinga+b+c+d≤N, the secure computation method comprising by circuitry of eachsecure computation device: receiving, over a network, an input of thesecure texts ([a], [b], [c], [d]), wherein the original respectivefrequencies a, b, c and d are concealed from each of the secretcomputation devices; computing a secure text ([a₀], [b₀], [c₀], [d₀]) ofa combination of reference frequencies (a₀, b₀, c₀, d₀) which areintegers satisfying a₀+b₀=a+b, c₀+d₀=c+d, a₀+c₀=a+c, and b₀+d₀=b+d,determining integers h₀ and h₁ satisfying h₀≤h₁ by the circuitry of thesecure computation device, and computing [a_(i)]=[a₀]+i, [b_(i)]=[b₀]−i,[c₀]=[c₀]−i and [d_(i)]=[d₀]+i for i=h₀, . . . , h₁, and obtaining a setS={([a_(i)], [b_(i)], [c_(i)], [d_(i)])}_(i) of secure texts ofcombinations of frequencies (a_(i), b_(i), c_(i), d_(i)) by thecircuitry of the secure computation device.
 7. A non-transitory computerreadable medium including computer executable instructions that make asecure computation device perform a method, the secure computationdevice being configured to be implemented in a secure computation systemcomprising three or more secure computation devices, wherein it isassumed that a, b, c and d are non-negative integers, a is a frequencyon a first row and a first column of a 2×2 contingency table, b is afrequency on the first row and a second column of the contingency table,c is a frequency on a second row and the first column of the contingencytable, d is a frequency on the second row and the second column of thecontingency table, [a], [b], [c] and [d] are secure texts of therespective frequencies a, b, c and d, and N is an upper bound satisfyinga+b+c+d<N, the method comprising: receiving, over a network, an input ofthe secure texts ([a], [b], [c], [d]), wherein the original respectivefrequencies a, b, c and d are concealed from the secret computationdevices in the secure computation system; computing a secure text ([a₀],[b₀], [c₀], [d₀]) of a combination of reference frequencies (a₀, b₀, c₀,d₀) which are integers satisfying a₀+b₀=a+b, c₀+d₀=c+d, a₀+c₀=a+c, andb₀+d₀=b+d, determining integers h₀ and h₁ satisfying h₀≤h₁; andcomputing [a_(i)]=[a₀]+i, [b_(i)]=[b₀]−i, [c_(i)]=[c₀]−i and[d_(i)]=[d₀]+i for i=h₀, . . . , h₁, and obtaining a set S={([a_(i)],[b_(i)], [c_(i)], [d_(i)])}_(i) of secure texts of combinations offrequencies (a_(i), b_(i), c_(i), d_(i)).